diff options
| author | Antonio Ospite <ospite@studenti.unina.it> | 2010-10-05 17:20:16 +0200 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-04-17 16:15:54 -0400 |
| commit | 24977195f50960222eb9ad2982e6cd252ff9f63f (patch) | |
| tree | 3c3775d9af52c1f815e25c997c01ba16498412af /drivers | |
| parent | 0ab884d56d480246b098925c2e2586612822610c (diff) | |
HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl
commit d20d5ffab92f00188f360c44c791a5ffb988247c upstream.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid]
[...]
This is reproducible by disconnecting the device while userspace does
ioctl in a loop and doesn't check return values in order to exit the
loop.
[PG: slightly/trivially reworked for backport to 34]
Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/hid/hidraw.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c index 6eadf1a9b3cc..0db1a0f5d2a0 100644 --- a/drivers/hid/hidraw.c +++ b/drivers/hid/hidraw.c @@ -243,6 +243,11 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, void __user *user_arg = (void __user*) arg; lock_kernel(); + if (!dev) { + ret = -ENODEV; + goto out; + } + switch (cmd) { case HIDIOCGRDESCSIZE: if (put_user(dev->hid->rsize, (int __user *)arg)) @@ -315,6 +320,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd, ret = -ENOTTY; } +out: unlock_kernel(); return ret; } |